[Buildroot] [PATCH 0/1] jquery: bump to version 3.5.1

[Buildroot] [PATCH 0/1] jquery: bump to version 3.5.1

[Ignacy Gawędzki]

Hi,

It seems at least some packaged jQuery plugins are not necessarily
adapted to support jQuery version 3+.  It seems jquery-datetimepicker
may not be compatible, while jquery-sidebar declares no dependency on
any jquery version, but has not been updated for the past five years.

Nevertheless, given the several known vulnerabilities of jQuery
versions <3.5.0, it would be nice to bump it to version 3.5.1 anyway.

Cheers,

Ignacy Gaw?dzki (1):
  jquery: bump to version 3.5.1

 package/jquery/jquery.hash | 2 +-
 package/jquery/jquery.mk   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

-- 
2.25.1

[Buildroot] [PATCH 0/1] jquery: bump to version 3.5.1

[Thomas Petazzoni]

On Wed, 14 Oct 2020 13:08:19 +0200
Ignacy Gaw?dzki <ignacy.gawedzki@green-communications.fr> wrote:

> It seems at least some packaged jQuery plugins are not necessarily
> adapted to support jQuery version 3+.  It seems jquery-datetimepicker
> may not be compatible, while jquery-sidebar declares no dependency on
> any jquery version, but has not been updated for the past five years.

So perhaps we should drop those jquery plugins from Buildroot before
updating, no? Or you're just not sure that they are not compatible ?

Thomas
-- 
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

[Buildroot] [PATCH 0/1] jquery: bump to version 3.5.1

[Ignacy Gawędzki]

On Wed, Oct 14, 2020 at 01:37:13PM +0200, thus spake Thomas Petazzoni:
> On Wed, 14 Oct 2020 13:08:19 +0200
> Ignacy Gaw?dzki <ignacy.gawedzki@green-communications.fr> wrote:
> 
> > It seems at least some packaged jQuery plugins are not necessarily
> > adapted to support jQuery version 3+.  It seems jquery-datetimepicker
> > may not be compatible, while jquery-sidebar declares no dependency on
> > any jquery version, but has not been updated for the past five years.
> 
> So perhaps we should drop those jquery plugins from Buildroot before
> updating, no? Or you're just not sure that they are not compatible ?

If I were to choose between dropping those packages vs. being stuck
with the old jQuery, I would definitely prefer the former.  Most of
the plugins seem to support jQuery 3.5.1 and for those that don't out
of the box, anyone interested can later dig them out, adapt them and
repackage them.

Another package that depends on the old jQuery and that hasn't been
bumped for a long time is flot (0.8.3 dates back to 2014).  It looks
like the project has since been taken over and migrated to Github,
were it is currently released as version 4.2.1.  I can attempt a
repackaging myself and submit a patch here.

-- 
Ignacy Gaw?dzki
R&D Engineer
Green Communications

[Buildroot] [PATCH 0/1] jquery: bump to version 3.5.1

[Ignacy Gawędzki]

On Wed, Oct 14, 2020 at 02:39:44PM +0200, thus spake Ignacy Gawedzki:
> On Wed, Oct 14, 2020 at 01:37:13PM +0200, thus spake Thomas Petazzoni:
> > On Wed, 14 Oct 2020 13:08:19 +0200
> > Ignacy Gaw?dzki <ignacy.gawedzki@green-communications.fr> wrote:
> > 
> > > It seems at least some packaged jQuery plugins are not necessarily
> > > adapted to support jQuery version 3+.  It seems jquery-datetimepicker
> > > may not be compatible, while jquery-sidebar declares no dependency on
> > > any jquery version, but has not been updated for the past five years.
> > 
> > So perhaps we should drop those jquery plugins from Buildroot before
> > updating, no? Or you're just not sure that they are not compatible ?
> 
> If I were to choose between dropping those packages vs. being stuck
> with the old jQuery, I would definitely prefer the former.  Most of
> the plugins seem to support jQuery 3.5.1 and for those that don't out
> of the box, anyone interested can later dig them out, adapt them and
> repackage them.
> 
> Another package that depends on the old jQuery and that hasn't been
> bumped for a long time is flot (0.8.3 dates back to 2014).  It looks
> like the project has since been taken over and migrated to Github,
> were it is currently released as version 4.2.1.  I can attempt a
> repackaging myself and submit a patch here.

I'm having an issue with the packaging of flot 4.2.1.  From the
beginning, flot is being shipped with its own jQuery source (actually
it's been v1.8.3 all the way).  The original packager for Buildroot
decided not to install this source and use the one from the jquery
package instead.

I have currently no way to test whether flot works properly with
jQuery 3.5.1 and cannot recommend anything but to drop this package
as well.  Unless we make it depend on !BR2_PACKAGE_JQUERY and make it
install its own source of jQuery.

-- 
Ignacy Gaw?dzki
R&D Engineer
Green Communications

[Buildroot] [PATCH 0/1] jquery: bump to version 3.5.1

[Michael Nosthoff]

Hi,

On 14.10.2020 13:37, Thomas Petazzoni wrote:
> On Wed, 14 Oct 2020 13:08:19 +0200
> Ignacy Gaw?dzki <ignacy.gawedzki@green-communications.fr> wrote:
>
>> It seems at least some packaged jQuery plugins are not necessarily
>> adapted to support jQuery version 3+.  It seems jquery-datetimepicker
>> may not be compatible, while jquery-sidebar declares no dependency on
>> any jquery version, but has not been updated for the past five years.
> So perhaps we should drop those jquery plugins from Buildroot before
> updating, no? Or you're just not sure that they are not compatible ?



jquery-datetimepicker seems to still be alive. see [0]. If I look at the
npm page [1] it seems to have some dependencies which makes me wonder if
this package was ever actually usable in BR.

And as this is a pretty niche plugin I'm also wondering: the tendency in
the js ecosystem is to use npm for everything. If you look at the
install instructions it's for most packets "do npm -i packagename".
So with the fast pace the js world is going I would be really surprised
if anybody would still use packages that haven't been updated for 5+ years.

I have myself a jquery application on my BR target. But i just deploy
jquery with the rest of my application package.

So we should maybe just drop most of the jquery-* packages. (jquery
itself might be useful though)

Regards,
Michael

[0] https://github.com/xdan/datetimepicker/commits/master
[1]
https://www.npmjs.com/package/jquery-datetimepicker?activeTab=dependencies